HashiCorp Vault LIST returns all paths regardless of caller policy with no filtering

vault list on a KV mount returns every path even if the calling token has no read/write permission on most of them. Operators cannot scope the list output to paths the user can actually access. The issue has been open since 2018 with 106 reactions. vkv (a third-party tool with 109 stars) does recursive listing but does NOT read Vault policies to filter results; it still shows all paths. No tool exists that reads a token's effective policies and renders only the paths the caller can legitimately operate on.